go/proxyd: Add support for additional SSL certs#1818
go/proxyd: Add support for additional SSL certs#1818mslipper merged 1 commit intoethereum-optimism:developfrom
Conversation
🦋 Changeset detectedLatest commit: 6c7f483 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
mslipper
changed the title
Codecov Report
@@ Coverage Diff @@
## develop #1818 +/- ##
========================================
Coverage 72.00% 72.00%
========================================
Files 70 70
Lines 2318 2318
Branches 345 345
========================================
Hits 1669 1669
Misses 649 649
Flags with carried forward coverage won't be shown. Click here to find out more. Continue to review full report at Codecov.
|
|
I was think more along the lines of adding a TLS config which defines the CA certs to use explicitly, like https://gist.github.com/xjdrew/97be3811966c8300b724deabc10e38e2#file-client-go-L15-L35 This would allow custom CA certs to be loaded from file, as well as prepare for client cert auth. |
go/proxyd/entrypoint.sh
Outdated
There was a problem hiding this comment.
Shouldn't this step happen at build time to make it reproducible?
There was a problem hiding this comment.
update-ca-certificates needs to be run whenever the supplied certificates change. Since we support bind-mounting the certificates at runtime, this needs to happen before executing the proxyd binary.
There was a problem hiding this comment.
Updating certs from the internet at runtime is asking for trouble.
Can we default to the container CA certs, but allow specifying a CA file at runtime (end drop the entrypoint script)?
There was a problem hiding this comment.
update-ca-certificates doesn't update certs from the internet, it just appends all certs in the ca-certificates directory into one big file in /etc/ssl: https://gitlab-test.alpinelinux.org/alpine/ca-certificates/-/blob/master/update-ca.c.
That said, I think it's also useful to specify a CA file at runtime for things like client certificates, so I've added that functionality.
There was a problem hiding this comment.
Got it, I thought that update-ca-certificates called out to the network and downloaded the latest certs from the alpine registry
mslipper
force-pushed
the
feat/additional-certs
branch
from
00f9c86 to
3881a30
Compare
|
Done, updated to support custom CAs via the following backend config: # Path to a custom root CA.
ca_file = ""
# Path to a custom client cert file.
client_cert_file = ""
# Path to a custom client key file.
client_key_file = "" |
mslipper
force-pushed
the
feat/additional-certs
branch
from
3881a30 to
6c7f483
Compare
## Overview Stops the safe head walkback within sync start at genesis, in case there aren't enough L2 blocks to cover a full sequence window. Co-authored-by: theo <80177219+theochap@users.noreply.github.com>
4 participants
Fixes ENG-1704